Slashdot Mirror
Kama Sutra Worm Could Make For A Bad Friday
mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
For references, these are the enumeration names and where to go to make sure you have the latest anti-virus signature. Remember, this variant will uninstall and delete most anti-virus software so it's important to recognize it before it goes active tomorrow. Most virus definition software refers to it as CME-24. This is important since this worm has many different names including Nyxem.E, BlackWorm, Grew and Mywife.E.
More on the worm and its permutations and statistics on spreading.
A very detailed analysis with all types of files that may be affected.
And, if it's worth anything to you, the Microsoft advisory which seems to tout that Windows Live Safety Center Beta can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.
My work here is dung.
Better back up that pr0n too! :P
... really should have more flexible security.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).
In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.
Developers: We can use your help.
This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!
And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?
"Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.
The only patch for stupid is a swift boot in the ass.
Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra.
How about a stupidty patch for opening up an attachment like the one described.
"He's lost in a 'floyd hole"
...transfer your important data to a new hard drive inside of a Mac.
Does it run on Linux?
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks
So I guess Kama Sutra could put some IT professionals in some awkward positions
Nothing great was ever achieved without enthusiasm
Like they learned from Happy99?
Keep in mind all of those Dells that ship with time limited anti virus trial software. Even if people know they need virus protection, they may not know that it's expired.
END OF LINE.
just turn your computer off before midnight, and leave it off until saturday.
-- lol pwned
...to CDs, DVDs, zip drives, ...
What is this, 1996?
Anyway I like how virus names are slowly getting edgier. Kama Sutra is a good one, but it'll be great fun when someone names a virus the Angry Dragon, Cleavland Steamer, or the Dirty Sanchez. I eagerly await the day when the words "Rusty Trombone hits America hard" grace CNN's frontpage :)
I'm sorry? It won't be super destructive? May I ask what you define as a super destructive virus? Overwrting the contents of all MS Office documents (not just deleting them) is extremly devestating. Even with backups the time it would take to restore the files would be a lot of downtime. Then you look at all the people who don't have backups. People and businessess. That could result in serious economic damage as companies are forced to re create there entire business. Was your post meant as a joke or...? You evidently have never had to recover from a virus infection of any magnitude. I have and its not easy. It takes time and its a race against the clock.
Charles Wyble System Engineer
Because the kids moving the stop sign were purposefully trying to cause harm. Microsoft didn't make Windows insecure on purpose. If MS could be charged for not securing windows, the Stop sign manufacturer could be charged for not making the stop sign tamper proof.
Also, I don't think computer viruses cause all that many deaths.
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks
As bad as this day? http://images.amazon.com/images/P/0689711735.01._S CLZZZZZZZ_.jpg
//mah favorite book
You mean this? The text says it was manslaughter, which is fair enough, and that it was overturned, or did you mean a different case?
It's not really a worm. What, exactly, is microsoft supposed to patch?
Sure. But I reckon gradually corrupting small parts of them is still worse. You might only realise you were infected months later, when the quarterly financial figures come out totally whacked, and you'll spend the rest of forever in the company of accountants and auditors trying to track down the correct figures.
Fragging out a file all at once? Then the victim realises something's up, gets the machine fixed, loses some work. Imperceptibly corrupting the file? Victim keeps spreading the virus, and every version of every file he works on is suddenly untrustworthy...
Real Daleks don't climb stairs - they level the building.
end up fucking yourself.
This URL would seem to provide some hints about how to check whether you're infected.
d .html
It mentions some registry keys that the worm sets up.
http://www.sophos.com/virusinfo/analyses/w32nyxem
"Absorbing your worst..."
I wouldn't call it a Microsoft insecurity issue, but a stupid user issue. The user has to install it for it to work, the user actually has to be involved and allow it onto their box. The same type issue can be had for a Linux box and you don't even have to be a root user to be affected; someone emails you unknown app and like these windows dumbasses you run it can wack all of the Openoffice documents you have been using to write your disertation for the past year is gone.
A stupid user is stupid user, the article summed it pretty well: "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
"As much as I appreciate the warning, hints on HOW to know if you're infected would have certainly helped."
As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.
So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:
- Symantec
- McAffee
Haydn.
Time is an illusion. Lunchtime doubly so. - Douglas Adams
Simple. The End User License Agreement absolves Micrsosoft of all responsiblity for defects including ones they have been NOTIFIED ABOUT. The entire security community is very good about informing the secure@microsoft.com team about vunerabilities. For that matter so is /. the WSJ and CNN. Every copy of there software ships with a get out of jail free card.
Charles Wyble System Engineer
Try and get your knee to settle down and RTFA
Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no "patch" that can be downloaded to ward off Kama Sutra.
"This is something that is not inherent in the operating system," Sergile said.
"Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance," he said.
I like to jump all over Microsoft for their lax security and gaping vulnerabilites as the next guy, but this time it isn't an unpatched hole in office or RPC or something causing this.
There isn't anything you can do to protect your system from this worm, aside from not being dumb enough to click on an email attachment that says "free nekkid pikturs".
>Hopefully this worm will cause a bunch of monetary damage to some corporations
Apparently not, just horny/stupid military and home users:
Furst says the worm has spread to a lot of military addresses on the Internet (.mil), but mostly to ISPs (Internet Service Providers), meaning most of those infected are probably home users.
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
I've worked on large systems, including a multi-terabyte "data warehouse". No matter how big every system can get nightly incremental backups to save space. There is no way EVER you should be overwriting any previous backup. If you have that much data, and it's that valuable, you pay for whatever it takes to make every backup written once-only. Buy a set of drives or one drive with a large multi-disk feeder and pop in 100 7 Gb DVDs every night. Or better yet only do an incremental every night and a full weekly.
What's more expensive... write-once backups or the loss of all of your data? Pick one and good luck.
Developers: We can use your help.
True. Gradual corruption is worse but more difficult to do. With source control/revision tracking its almost impossible. And to date as far as I know there aren't any viruses that do this. I imagine if they do exist they are highly targeted payloads that attack specific companies. If the problem was widespread many organizations would report problems and an effort would be made to prevent infection. Although it would most likely be hard.
Charles Wyble System Engineer
After checking up on the virus through some of the links in the article...frankly, I would be surprised if most readers of Slashdot were affected. I thnk most Slashdotters are way too smart to engage in the sort of behavior (opening suspicious email attachments) that is necessary to allow infection.
I feel sorry for all the people who aren't, though.
Editor Emeritus and Senior Writer, TeleRead.org
I set my computer's clock 1 day ahead!
From TFA:
"So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.
Mr. Sergile, you obviously haven't met my cousin Alice.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
This one won't be super destructive, but a bit bad.
Maybe in your IT world it won't. That's great, but say that to the admin that has a user bring in a unsecured laptop, that brings down the email servers, gets them blacklisted. I'm sure that it won't be considered "a bit" bad when the exec's of the company want answers.... Anything that has the potental to damage/distroy data is destructive.
www.oobersworld.com - For those that ride.
This one will be more damaging than people think.
A lot of SMEs uses unsecured and passwordless network shares for sharing company data. Data that is stored in, you guessed it, *.doc *.xls, etc, etc files. This virus looks for shared drives such as this and will corrupt the files on them tomorrow.
If only one PC in the company is effected, I can see a whole lot of sore heads tomorrow at lunchtime.
I guess I should have paid more attention to this one.
May the Maths Be with you!
In other news IT professionals are clamouring to their CPA's asking if condoms, oils, edible underwear, chiropratic bills, candles, rose petals, personal lubricants, aphrodesiacs, and sex toys can be itemized deductions...
Bought the ticket, taking the ride.
"Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
:-)
Isn't the purpose of this article to patch user ignorance?
If I were more creative, and funnier, I would come up with many witty and similar analogies to the phrase "patching user ignorance."
Free smut is a yes yes for workplaces you can imagine it, 'hey look free porn' 'open it! lets see some hot school girl action' 'oh well nothing there, look at the time see you all tomorow' friday 3rd... 'hey where are all my files? The servers, network drives all gone!' Dust off your tape drives and press the rewind button tonight.
I feel a sudden illness coming on, could be a virus.
He who knows best knows how little he knows. - Thomas Jefferson
Actually there is a patch for user ignorance. It's called user education. The problem, of course, is that ignorant users are usually also ignorant on their own ignorance, and therefore don't apply this patch.
The Tao of math: The numbers you can count are not the real numbers.
That, or the "Windows = Computer" is so engrained in people that they use it interchangably without notice.
Even if they are trying to differentiate. It won't affect Joe Consumer, he will just associate windows with computer anyway.
Ah yes, because there were no windows viruses before linux.
Changa hates change.
Here's how to know the difference between a money-making press release, and an honest story: The press release says "Fear, fear, fear!!!"
The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool, which apparently removes all variants of the worm.
Here are manual instructions: WORM_GREW.A, Also known as: CME-24
Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools.
security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free
the media storage industry.
good work guys.
And I quote "God your stupid".
I rest the case defined in the message heading as a case of Slashdot user self-flagellation, which is not a part of the Karma Sutra.
"And even for home computer users who have never taken such precautions before" You mean an updated antivirus program? You would think after the thousands of worms that everyone would learn by now, especially those who know they have a tendency to click things for no reason.
Im having the same issue.
Although they have AntiVir 7 out and I just found out about it (and upgraded all the machines on the company LAN), so it might be just the influx of new users upgrading to version 7.... unless 7 has been out for a while and I was just in the dark.
Find Escorts, Strippers, Massage Parlours, Swingers
Any ideas if it will only attach files on local machines ore will it traverse to network shares of course only the ones without security?
This is because, while it may have been posted before, this is very helpful for some of us who are looking for resources to make sure we are covered in the last day before the attack. If it wasn't for the links I got off slashdot, I couldn't get my PHB's to approve my time to verify everything. Thus, an article is not a "dupe" if it is still useful. Hence, your complaints are offtopic.
As was this.
Watch for Penguins, they eat Apples and throw rocks at Windows.
Only assuming that the so-called "stupid person" understands that it was _this specific virus_ that did it, and remember what was done _on his part_ for it to end up this or that way.
A horse can't be sick, you know, even if he wants to.
"im not a virus...lol" *delete, Format C:* "Okay, i am now :)"
Sorry *ducks*
In the Soviet Union, signatures writes you!
you really, really have to work at it to fuck up a Linux box... with windows, just going online can be enough...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Even simpler: press control-alt-delete. If your computer does nothing, you're safe.
CasualSax's Rusty Trombone pounds the US in the IS.
Hmmm witty sig or funny sig? Maybe elitest techy sig!
Imagine a worm that quietly changes every instance of a certain word. For example, changing "earnings" to "B.S." and "mom" or "wife" to "shrieking harpy."
Gamingmuseum.com: Give your 3D accelerator a rest.
Why all the panic really? Can't a decent firewall stop the "injection" of this virus through a service/hole? Its a worm we're talking about after all... Just watch what you download/run keep the shields up and you should be fine. I've never been affected by any worms, but always had a properly configured firewall.
Hey, this isn't Flamebait, it's true. You can make whatever arguments you want (smaller target size), but Macs have been impervious to every big, newsworthy Windows virus in the past five years.
Do you realize how funny it becomes after the seventh time a big-time worm goes around in the Windows world and you're unaffected? When Blaster was rebooting the world's computers, when Code Red was making the rounds, when the WMF flaw was making people afraid to view email or visit unfamiliar websites, Mac users have just shaken their heads and kept on running. This Friday will be the same.
It's amazing the American economy has come to rely on something so unreliable. I switched my office to Mac last year because life is too short for this shit.
"Sufferin' succotash."
Step 1: Go into Date and Time properties Step 2: Click on Internet Time tab Step 3: Uncheck Automatically Synchronize Step 4: Click on Date & Time tab Step 5: Change the date to the 4th (saturday) Step 6: Click OK Step 7: Wait until it really is saturday and turn automatically synchronize back on. I'd reccomend this for everyone, whether you think you have it or not, just to be on the safe side.
F-Secure has details about this too.
/f %%i in (computerlist.txt) do (i on\Run /s | find "ScanRegistry" >>scanlist.txt 2>&1
Using the REG utility in WinXP or Win2K Resource Kit, it's not too hard to write a script to scan your PC's registries for this key. Something like
for
echo %%i >>scanlist.txt
reg query \\%%i\HKLM\SOFTWARE\Microsoft\Windows\CurrentVers
)
then look in scanlist.txt for any 'hits'.
There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.
This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.
So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:
1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).
2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.
I have tried to find out if clamav will detect this virus with no positive results. Does anyone know the status?
Tis better to be silent and thought a fool, than to open your mouth and remove all doubt --Abraham Lincoln
Anyone infected is supposed to download a revolver and shoot themselves in the head for being stupid enough to open an unknown attachment.
Here's my idea:
:D
We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.
My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.
Problem solved
You SOB!
My linux system just rebooted....
This is of course not true. It is quite possible to protect your systems against worms and other mishaps like this.
Learn a bit about security and limited user accounts. Make sure that normal users cannot write to directories like %programfiles%, %system% and %windir%. Don't allow users to work as administrator.
Install a service like TrustNoExe. Set it up so that executable programs are only allowed in %programfiles% and %windir% (and other directories that normal users cannot write, and that you use to store programs).
Now, when a user receives a program in mail or downloads it from the internet, it cannot be executed. Storing it somewhere in his writable directories (Documents and Settings directory, networkdrives) is possible but it just cannot be started.
It does not require user education, just an educated administrator.
but Macs have been impervious to every big, newsworthy Windows virus in the past five years.
Well no shit. My Ford has been impervious to every big, newsworthy Chevy recall in the past years.
Bad boys rape our young girls but Violet gives willingly.
"There is no 'patch' that can be downloaded to ward off Kama Sutra."
That's right. Once you get the Kama Sutra, you're fucked!
This isn't off-topic; it's an important distinction that should be encouraged. CBS News went so far as to not only characterize the worm as a Windows-only worm, but also mention that Macs were unaffected.
People need to be told that it's not a "computer virus," it's a Windows virus.
"Sufferin' succotash."
It's good to be using a Mac when the virii and worms come around, but if the world had chosen Macs instead, they'd be the ones under attack.
As much as I love my Mac, I don't think it's technically any more difficult to attack. It's just that people don't bother writing malware for such a small percentage of the market.
SCISNE? ANUS SIMIAE!
I have no idea of what this worm is nor do I care. From the top of my linux box it'll be another friday like the others, where I may have the pleasure to see more Win users complain about their OS, without them doing anything to change OS.
It may be a bit cruel, but I'm already impatient to say my old "I told you so!" to everyone who wouldn't do the switch to linux.
Say WHAT? The idea behind backups is to make your data storage more reliable, not less.
No, I get what you're saying. I was responding to the OP that it was Microsoft's fault that there was not OS patch available and that this left users vulnerable.
I guess if I had a chance to edit my post, I would have worded it a bit differently.
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
It's a regular email attachment virus, nothing wormy about that. "The main difference between a computer virus and a worm is that a virus can not propagate by itself whereas worms can" This requires Stupid user interaction, without it it wont spread and do it's shitznitz. Anyhow, i would say that anyone still running windows, clicking attachments left and right, should in all honesty not be on a account with system rw privs. Hell, i regard linux as somewhat secure and I still dont run as root or superuser lest i'm trying to upgrade stuff or change the system.
Wait.. How long as windows done bash scripts?
Can you be Even More Awesome?!
"Dood, that raver chick gave me the KSW last night and it's been itching all day!"
I guess the Kama Sutra Worm STD might have more positions, but the Tantric Worm lasts longer.
"We now return you to your regular slashdot blather"
...called GNU/Linux OS :)
Windoze is no more than a game platform and should not be used as other tool if you are smart enough
sex is better than war!
Not to mention "insight a panic"...
if I had insight as to what causes a panic then perhaps I'd learn how not to INCITE one.
But one mistake makes me think the original poster is an idiot. Two mistakes like this makes me think the original poster was trying to be funny. Who knows?
Paste this in Word 'DATA Error [47 0F 94 93 F4 K5]', select the charators '47 0F 94 93 F4 K5' and change the font to Wingdings. The virus harms data, and can disable mouse and keyboards.
I know I am!
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
But at least yesterday one of the first posts gave this link:t ails.aspx?name=Win32%2FMywife#Aliases
http://www.microsoft.com/security/encyclopedia/de
Note that this link provides a REMOVAL TOOL. I guess Microsoft doesn't have some sort of conspiracy against unpaying customers after all.
Lol I think we did but just try again: it updated now (at least in Europe).
this comment is provided "as is" and without any express or implied legibility or congruity [...]
Our users have had it pounded into their heads never to open attachments on messages with odd subjects.
But I'm just waiting to see who the pervs are. This should be interesting when someone comes to me and says their files have been deleted. Hmmmm.. and what were you trying to look at.
I'm curious. If the "head of Macintosh products at Symantec" says that OS X hasn't had any viruses... what does he do? Why do they sell Macintosh AV software?
Do people pay for "peace of mind", and regularly download completely empty virus definition files? ;) I'm sure people would buy it if they did, but I'm assuming they do other things as well.
the layman's guide to computer science
The article states that the virus executes on the third of this month (tomorrow.)
Why not just wind back the clock?
I'm serious. I've fooled many a shareware program that locks the program after x days by setting the date back to when I first installed it (or even earlier, which makes for some funny notices.)
Unless the Kama Sutra virus is programmed in such a way as to store the date and time installed, and then keep track of every (milli)second that's past, and execute once enough seconds have passed to put it on the 3rd, I would think you could easily fool it by simply changing the date on your computer back a week or two. If you're really anal about calendars, you can find a year where the months start on the same day.
Yes, this would mess up some other programs that use the computer's date, but temporarily wonky programs are better than completely deleted files, no? So, set the clock back, and wait until Microsoft finally releases their patch or whatever, if you're afraid that another virus scanner hadn't caught it.
They prevent the spread of windows viruses to their windows using friends and coworkers.
Macs way be immune to windows viruses, but they can still pass them along.
As the T-Shirt says: Social Engineering - Because there is no patch for human stupidity...
Hah!! *shakes head*
muszek: How long are you gonna lead this guy on? His sarcasm detector is clearly out to lunch.
It's "batch", not "bash".
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
I'd rather they were told it was a 'microsoft virus'. I would hate to read the headlines and think I needed to rush home and patch x11r6.
Dungeon Tactics : Free Open Source SRPG
I just checked all of the virus sites and they are all on 'green' alert level saying that there are not even an moderate threats out there right now. Either this has just been blown way out of proportion by CCN (slow news day) or all of the security companies think they already have this one solved.
Our IT department is taking no action since there is no elevated threat level.
The CNN article has a great quote: .sig of mine someday....
Unfortunately, there is no way to patch user ignorance...
I love it - might become a
I'm in my right mind and I have the answer to everything!
...and I have just fired up Word and Excel and everything still seems to be there.
Oh wait, I'm on a Mac.... Never mind!
They can't hide that they are apps. Windows will warn you that it's an app, and tell you not to run it. You don't need to run as an admin to run Windows. We have hundreds of computers in the department which users do not have admin access on. People run as admin because they are lazy. Besides, if your e-mail client saying "Warning, this could be a virus don't run it" and then your OS saying "Warning this oculd be a virus don't run it" isn't enough, changing the OK to a password field isn't going to do any good.
Exactly. This reminds me of an article I once read on bio-warfare. It mentioned that Ebola wasn't as dangerous of a bio-warfare agent because, even though it's highly lethal, it knocks out its victims extremely quickly--by the time you become contagious, you know you have it. A disease such as Smallpox, however, was far more dangerous--victims could be infected and contagious without knowing they had the disease, leading them to spread it to others.
:).
I'm recalling this from memory, so the disease names may be incorrect. But you get the concept
Ride the skies
I have Mac OS X 10.4.4 om my desktop machines and Ubuntu on my IBM laptop. Life is good. :)
WTF?!
It seems some moderators are having fun at my expense. Two posts moderated down to 0? Can someone explain? (Honestly, I'd like to know)
My (GP) post was on topic, and was valid criticism (which is, the CNN article does little to explain how to know if you're infected).
gcc: no input sig
I'm using FreeBSD, am I safe? I think I am, but with all the panic swirling around over this issue, I'm not sure. Some guy just ran past my cubicle screaming, "no one is safe!"
A Government Is a Body of People, Usually Notably Ungoverned
In aviation the US system prevails. The altitude of the flight is still measured in medieval feet, something like 33600. In normal scientific metric system it is 9600 meters.
As my professor said: "It is the shame to enter 21-st century with the Imperial System of Measurement". Still we did.
I blame the US archaic technological system of doing things. This is the reason of these endless vulnerabilities.
It is impossible to work like this. I think the UN has to create the International Body and come out with the Open Source Secure OS, based on the understandable scientific System of Measurements. The humankind shall not be the hostage of an undereducated Bill or whomever. We shall aspire to the modern secure computing.
For faster/easier protection, would it be effective to tar/rar/zip the files up? I'm thinking specifically for the non-tech friends of mine that I was warning.
You can use any bash version available for Windows. Cygwin Bash to start with but not excluding GNU Bash or many alternatives you can find from google (the one I linked is the first one from Google search for "Windows Bash").
They can't hide that they are apps. Windows will warn you that it's an app, and tell you not to run it.
Is this true for XP-SP2 now? The last time I tried running a new program by double clicking on it, I was given no warning that it was not data or that it was the first time this program was run. Is this fixed in all the older versions of Windows as well, because frankly not having this warning is a huge UI failure and vulnerability.
You don't need to run as an admin to run Windows. We have hundreds of computers in the department which users do not have admin access on.
This is true, if you just want to run a few, particular programs, and they are the right programs. This is not true in general. I've tried running as a non-admin as have several other employees here. We could not do our jobs. Too much software requires you to be admin to run. This includes software from MS. Basically, running as a non admin makes getting anything done very, very hard. You can't install most applications, can't run some applications and run into situations where you need the admin password about once a week. Our sysadmin gave up on the idea after about 10 days.
Besides, if your e-mail client saying "Warning, this could be a virus don't run it" and then your OS saying "Warning this oculd be a virus don't run it" isn't enough, changing the OK to a password field isn't going to do any good.
I see you fail to understand layers of privilege or UI design. First presenting a cancel/OK dialogue in Windows is utterly useless most of the time. This is because most of them are written in techno-babble and so many are presented that the average user just stops paying attention and starts clicking OK reflexively. It is simply one of the stupidest UI designs ever. Users should be presented with dialogues only upon rare occasions. They should be in clear English (or whatever language). They should have buttons that actually describe something useful like, "I trust this program and want it to be able to do anything to my computer" and "I don't trust this, don't let it do anything." Of course, in practice that layer of privilege is unworkable. What is really needed is the ability to run programs in a sandbox and grant them privileges as needed, i.e. "Run this program but don't let it use the internet, alter my OS, or touch my files." Asking for a password to do privileged actions works very well, provided users are not constantly asked for a password and provided that they have the control they need to grant some privileges instead of all.
This particular virus is basically a trojan. It works because most Windows systems do not inform the user when they are running a program instead of opening data. It works because they are not warned when a program wants to do something unusual. How often do you want to download a program, or get it via e-mail and you want that program to be able to edit your personal files? The answer is so rarely it makes a lot of sense to make the default behavior restrict it from that action, and let it ask if it wants to edit them. That would have stopped this virus dead. A good UI, a workable non-admin account, and good default permissions are what it takes to stop 99% of these viruses. Until that happens, blaming users is premature. They are not given the tools and options they need.
from Australia? Could be that we could figure out how bad this might be
"I wasn't talking to you, I was talking to the universe. It hates me, you know"
But cousin Alice sends me pictures like that all the time. Don't believe me? Go ask Alice.
But seriously though, incidents like this make me wonder whether we're doing the human race a disfavor by trying to protect all of these stupid people. If someone is going to click on random porn links, especially ones sent by unusual sources, maybe they deserve to have their computer ruined? I mean, we're not exactly talking about your grandma. Ok, well maybe your grandma, but somehow I don't suspect either of mine would click on such a link.
This sig has absolutely no significance and serves only to take up screen space and waste the time of the reader.
Any company that has to file a quarterly report or that would bother spending the rest of forever with accountants doesn't track their finances in file formats subject to virus infections or worms.
I agree with the main point of your post that a virus or worm that is undetected and subtle is more deangerous. A virus like this one that attacks common file formats could also bring an organization to its knees. However, many mission critical applications - such as finances - are kept in seperate systems that are not as open to this kind of attack.
"This is a really damaging worm. This is not one of those worms that is interested in having access to your machine for purposes later on. This worm will really damage your machine," Georgia Tech's Furst said.
It'll really damage my machine? What, it'll grab an ice pick and start stabbing the motherboard? It'll jam a soldering iron into the processor? Maybe take a hacksaw to the hard drive?
Somehow, I'm a bit more concerned about worms that ARE interested in having access to my machine for purposes later on. Thrashing my data? Pshaw. I've got backups for that, and if it only triggers once a year, double pshaw. Keylogging? Packet sniffing? Extracting personal data to defraud me out in the real world? Using my computer to conduct attacks on other computers, leaving the blame to me? I consider those a wee bit more dangerous than something that will just "really damage" my machine.
Demanding constant attention will only lead to attention.
Script above is not a /bin/bash script, you tool.
I wouldn't call it a Microsoft insecurity issue, but a stupid user issue.
I disagree. Stupid users can be the weak link, but at this point, they aren't there yet. A whole lot could be done to mitigate these types of viruses by the OS that is not done. Give the users good tools and if they still screw up you can complain.
The user has to install it for it to work, the user actually has to be involved and allow it onto their box.
This is true, but most Windows OS's don't do a reasonable job of distinguishing data and programs. Even those that do, use very poorly designed UI's to do so.
The same type issue can be had for a Linux box and you don't even have to be a root user to be affected; someone emails you unknown app and like these windows dumbasses you run it can wack all of the Openoffice documents you have been using to write your disertation for the past year is gone.
Perhaps for some brain-dead Linux distros this is true. In general, however, Linux makes it a lot harder to disguise programs as data (no hidden extensions). They also require the user to explicitly make a downloaded program executable (no double click and it runs). Also, most Linux machines have a workable non-admin account and use it as a default. This means the virus cannot disable the virus protection, as this one does. Finally, a few more secure Linux distributions run programs in virtual servers, requiring the user to explicitly grant it the ability to modify the user's files.
A stupid user is stupid user
And yet, that stupid user running the average Linux or OS X distribution would not have had a problem.
Windows needs to be fixed. It is under siege and still does not implement security even as good as most Linux or OS X boxes. What they should be doing is implementing better security, not worse. When a user gets a program via e-mail, the attachment should be labeled as such, explicitly. To run any new application the user should have to explicitly agree. This does not mean give them an OK/Cancel dialogue. The UI throws so many techno-babble OK/Cancel dialogues at the average user they are conditioned to click OK to everything. They should be given real choices like "I trust this program, run it" and "Don't run this program." Even when run, the program should default to executing in a sandbox environment, with no access to the internet or to read/write any user-space files. It should be able to read necessary system files, but not write them. It should not be able to change existing DLLs. If the program tries to do any of these things, the user should be informed in plain English and given the opportunity to enable the program to do so. Think, "This program wants to read your e-mail address book (allow it to read your addresses)(Don't let it read your addresses). This program wants to access the internet in a way normally used by mail programs (allow it to send e-mail)(prevent it from sending e-mail)." Windows should install a non-admin account by default and use that as the user's normal login account, thus an additional password would be required to disable the anti-virus.
All of these abilities can be set up today with existing OS's and a company the size of MS should be able to have them working in a few month's time. It is easy to blame the user, but the user has to work with the tools he has. Sure maybe they clicked "OK" but they've already had to click it 50 times today just to do their normal work. After a while, you can't expect everyone to pay attention. I call upon MS to write a more secure OS, with a workable GUI. Until they do so, I call upon everyone here to stop cutting them slack for what "dumb users" do. They are not the weak link here. Not yet, by a long shot. You should not have to be a computer expert to use a tool designed for non-experts. Both Current and older versions of Windows need a lot of work. After it is done, then user education is needed, but until that time it is just not going to work.
...one computer is a Apple PowerBook running Mac OS X and the other is a IBM ThinkPad running SuSE Linux... :-D
I do however expect to make a lot of money the next 3 - 5 days.
--
What was the goal of DARPA net ? share information between different platforms.
May I ask what you define as a super destructive virus?
:)
If it infected my FreeBSD desktop and wiped out my text and OpenOffice files. Now THAT would be devestating!
OTOH, if it's just Windows... eh, not that big a deal. Must be a perspective thing
The line must be drawn here. This far. No further.
If almost everybody in the world drove Fords, and Fords were hit with major problems every month that cost companies millions of dollars in time and money, while Chevy's kept running smoothly without a hitch, would you fault Chevy drivers for mentioning that fact?
Especially if Fords were as insecure as Windows XP (still running admin accounts in the year 2006...gotta love it).
"Sufferin' succotash."
http://service1.symantec.com/SUPPORT/nav.nsf/docid /1999041209131106
/ virus.aspl edgebaseAnswer/0,295199,sid63_gci980535,00.html
Care to argue with Symantec on the definition?
How the hell did My above post get modded 'troll' anyways? There's your proof. Oh, need more proof?
How... http://www.webopedia.com/DidYouKnow/Internet/2004
About... http://www.computer-lynx.com/a-virus-or-worm.htm
THIS??? http://expertanswercenter.techtarget.com/eac/know
Someone needs to go back to computer pre-school. I knew the difference in those 15 years ago, when I was 8. Tool.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I metculously setup my homeLAN machines at home as well as my college student's machines to have firewalls and spyware scanners and AV scanners as well as resident scanners. I have the routers set up to deflect everything they are able. I turn off services I know are a problem, I have resident scanners for email, web, p2p, IM, the works. I run hijack and rootkit testers on all the clients and set up the machines to flush all their tempfiles and browser caches on shutdown. I have hostfiles locked.
And just watched someone look at an AV scanner popup with colors and flashing lights that it captured a bug - what do you want to do with it? And this person couldn't cancel it, ignore it fast enough.
I quit. People are morons.
Tomorrow I will have a job!!!
I am currently looking for a job (if you know someone -> evi@valerieandevi.be) and freelancing on the side. Tomorrow will be a great day for me... all of a sudden hundreds of company's begging me to come in to fix them and restore the backups they don't have.
NO I DIDN'T CREATE THE VIRII [sic] but I can think wishfully can't I?
Custom electronics and digital signage for your business: www.evcircuits.com
install this using wine?
Check out my sci-fi/humor trilogy at PatriotsBooks.
<span class="diff"> /> />
</li></ol>
<h3>Snort Signatures
</span><br
<span class="diff">
;</h3>Joe Stewart (Lurhq.com) provided [...] of the worm:
</span><br
<span class="diff">
and the like acceptable. While asserting html4/strict.dtd - best laugh I've had this week. If they can't master basic HTML (straddling a /H3 with a SPAN?!?!) it they probably shouldn't be allowed to run a webserver, let alone attempt to advise people on security matters.
I, for one, can't wait to get home and see if all my files have been deleted. I've been running low on disk space, but I've been too lazy to delete old data myself. Thanks, Kama Sutra! You saved the day.
https://www.eff.org/https-everywhere
They can't. When you try and open attachments you get a dialog that tells you it's a bad idea and the default response set to "Don't Open". Applications should not be able to edit the registry without warning the user.
How is the OS supposed to tell the difference between a legitimate registry change and a malicious one ?
Users should not need to run as Administrator to make their computers work properly.
I agree. Blame the people who are writing software that does, it's their fault.
The registry is itself pretty sucktastic as far as security design goes.
Bollocks. The Registry has per-user ACLs on each key. It's got a better "security model" than most OSes.
...isn't this the kind of threat that forced the government to put SkyNet online?
*tinfoil head dress*, "ON!!".
Authority questions you. Return the favor.
How is the OS supposed to tell the difference between a legitimate registry change and a malicious one ?
Good question. Frankly, that's a primary reason why the Registry is a near-complete design failure.
Here's some guidelines:
Preference data that is specific to a particular application should be able to be changed by that application whenever it wants to. Sensible OSs tend to do this by having separate files which hold per-app data, but there's nothing inherently wrong with a database model which keeps Windows from using this type of model. Moreover, this should not EVER require "admin" privileges, although one might want a "kiosk" class of user which prohibits even this.
Preference data which modifies system behavior should require direct and specific user approval. Not many OSs get this right, although most do a better job than Windows.
Preference data which modifies OTHER apps should not be allowed, except with the "permission" of the other app (allowing for config utilities and plugins). Nice ideal, but generally I don't see that implemented anywhere. The failback SHOULD be to treat other apps just like system data, but generally OSs tend to treat other-app prefs the same as this-app prefs for convenience.
I agree. Blame the people who are writing software that does, it's their fault.
In my experience, the general reason apps require Administrator privileges to run is that they want to be able to modify the Registry. See above. Generally, these changes are of the first nature (remember what the user had set for preferences, etc). Many times, only a small subset of what an application does will require Admin privileges, but as there is no escalation procedure in the OS, they have to require Admin privileges from the outset, or not provide those utilities at all.
Which, yes, sucks for the user. But blaming it on the app writer instead of acknowledging that it stems from poor OS design is just plain silly. While programmers and designers do tend to be lazy, it's hard to believe that thousands of separate developers all chose to be lazy around the same central issue without an underlying problem there. It's like getting reports of all your users clicking the wrong button and determining that the button's not poorly designed; you just need smarter users.
but Macs have been impervious to every big, newsworthy Windows virus in the past five years.
Well, of course they are. That's why they are called Windows viruses.
Wait! This just in: Windows is impervious to Linux rootkits.
...switch to a system that doesn't have such horrible security.
I'm not quite sure I follow. About the only qustionable design aspect of the Registry is the usage of a solely binary-file backend (which, when you consider it was conceived back around the 1990-93 timeframe, is quite justfiable).
Preference data that is specific to a particular application should be able to be changed by that application whenever it wants to.
Within the context of the user, yes.
Sensible OSs tend to do this by having separate files which hold per-app data, but there's nothing inherently wrong with a database model which keeps Windows from using this type of model.
Windows[0] does this with per-user, per-application Registry keys. Or, basically, the equivalent of ~/.<application> directories in unix. There are also system-wide application Registry keys, the equivalent of /etc/<application> in unix.
Moreover, this should not EVER require "admin" privileges, although one might want a "kiosk" class of user which prohibits even this.
If an application developer doesn't use the per-user Registry locations and instead chooses to use the system-wide Registry and _assumes_ that the user will be running as Administrator and able to modify it, then there's not much Windows can do about it, nor is there any blame that lies in the hands of Microsoft.
Preference data which modifies system behavior should require direct and specific user approval. Not many OSs get this right, although most do a better job than Windows.
This is all very hand-wavy, so it's nearly impossible to respond. However, am I right in assuming that a) regular users shouldn't be able to modify system-wide defaults and b) even for users that have the privileges to do so, they should be bombarded with "Are you sure" dialogs at every turn ?
Preference data which modifies OTHER apps should not be allowed, except with the "permission" of the other app (allowing for config utilities and plugins). Nice ideal, but generally I don't see that implemented anywhere. The failback SHOULD be to treat other apps just like system data, but generally OSs tend to treat other-app prefs the same as this-app prefs for convenience.
I'm not really sure what you mean by "preference data". I'm assuming you mean that for application A to make any changes to application B's configuration data, then application A must register with, and have the approval of, application B.
I hope you can see why this would make a general purpose editor (ie: RegEdit) completely unworkable and would seriously hinder - if not make impossible - troubleshooting and recovery.
In my experience, the general reason apps require Administrator privileges to run is that they want to be able to modify the Registry.
More specifically, they want to edit the *system-wide* Registry that, by default, only high-privilege users may do. These applications are broken, and should be using the per-user Registry hives.
See above.
Your apparent assumption (that the Registry is a monolithic entity with no permissions capabilities or user/applicaiton/system separation) is wrong. Hence, so are your conclusions.
Generally, these changes are of the first nature (remember what the user had set for preferences, etc). Many times, only a small subset of what an application does will require Admin privileges, but as there is no escalation procedure in the OS, they have to require Admin privileges from the outset, or not provide those utilities at all.
Firstly, there are "escalation procedures" in the OS.
Secondly, these applications are broken because they are trying to write to the wrong part of the Registry, that they do not (nor should) have permissions to modify. It is analagous to a random unix user's application trying to modify parts of /etc, rather than using ~ like it s
Your comment has absolutely nothing to do my reply or the quote I replied to.
Bad boys rape our young girls but Violet gives willingly.
I mirror my disk and then once in a while (once a month or so) I copy data I consider important to an external drive which is locked under key.
The only way I would lose my personal data is if there was a catastrpophic problem, in which case data integrity of my family photos and video would be the least important of my concerns.
IANAL but write like a drunk one.
If it is possible for you to get your email client to execute attachments, then your email client is defective. Patch it or replace it.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.